diff options
| author | Philippe Mathieu-Daudé <philmd@redhat.com> | 2019-06-13 23:34:06 +0200 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2019-07-02 09:43:58 +1000 |
| commit | 740a19313b85527f6984b0fd4fee9b683b4ea1e2 (patch) | |
| tree | 5a153ce899eb48a9120aa0abb9db65fad6eedcd9 /hw | |
| parent | c29a0b0fb3520a2ab5fe566bf39340b4ef3efeb9 (diff) | |
| download | qemu-740a19313b85527f6984b0fd4fee9b683b4ea1e2.zip qemu-740a19313b85527f6984b0fd4fee9b683b4ea1e2.tar.gz qemu-740a19313b85527f6984b0fd4fee9b683b4ea1e2.tar.bz2 | |
spapr_pci: Fix potential NULL pointer dereference in spapr_dt_pci_bus()
Commit 14e714900f6 refactored the call to spapr_dt_drc(),
introducing a potential NULL pointer dereference while
accessing bus->parent_dev.
A trivial audit show 'bus' is not null in the two places
the static function spapr_dt_drc() is called.
Since the 'bus' parameter is not NULL in both callers, remove
remove the test on if (bus), and add an assert() to silent
static analyzers.
This fixes:
/hw/ppc/spapr_pci.c: 1367 in spapr_dt_pci_bus()
>>> CID 1401933: Null pointer dereferences (FORWARD_NULL)
>>> Dereferencing null pointer "bus".
1367 ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev),
1368 SPAPR_DR_CONNECTOR_TYPE_PCI);
Fixes: 14e714900f6
Reported-by: Coverity (CID 1401933)
Suggested-by: Greg Kurz <groug@kaod.org>
Suggested-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20190613213406.22053-1-philmd@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/ppc/spapr_pci.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c index 957ae88..fbeb1c9 100644 --- a/hw/ppc/spapr_pci.c +++ b/hw/ppc/spapr_pci.c @@ -1356,12 +1356,11 @@ static int spapr_dt_pci_bus(SpaprPhbState *sphb, PCIBus *bus, _FDT(fdt_setprop_cell(fdt, offset, "#size-cells", RESOURCE_CELLS_SIZE)); - if (bus) { - pci_for_each_device_reverse(bus, pci_bus_num(bus), - spapr_dt_pci_device_cb, &cbinfo); - if (cbinfo.err) { - return cbinfo.err; - } + assert(bus); + pci_for_each_device_reverse(bus, pci_bus_num(bus), + spapr_dt_pci_device_cb, &cbinfo); + if (cbinfo.err) { + return cbinfo.err; } ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev), |